Hardening: Brute-force mitigation

[maximilianwank]

I want to deploy Vaultwarden such that it is accessible over the internet. Of course, I had a look at the Hardening Guide.

In the chapter Brute-force mitigation (which I find extremely important), I came across two things:

One, relatively easy, way to mitigate this, is setting up fail2ban which blocks ipadresses after too many failed login attempts.

This is already a Vaultwarden security feature that can be controlled by LOGIN_RATELIMIT_SECONDS and ADMIN_RATELIMIT_SECONDS. Why does the wiki suggest fail2ban, if Vaultwarden comes with a very similar built-in feature? Am I missing something here?!

When two-factor-authentication is not in use, it is (in theory) possible to brute-force user passwords and thus gain access to their account.

I know it's not explicitly stated but one could easily misinterpret this sentence. With 2FA enabled, brute-force is a little bit harder but not impossible. To be precise, the entropy added by a 6 digit code is ~20 bits.

If there is a fruitful discussion in this thread, I would gladly summarize everything and post it to the wiki.

[RealOrangeOne]

Why does the wiki suggest fail2ban, if Vaultwarden comes with a very similar built-in feature

Because there's more to Vaultwarden to just login, and more to rate limiting with fail2ban than just brute force protection.

[maximilianwank]

Ok, do you have any examples? At least in the wiki, there are none. As I said: I would gladly add them to the wiki.

Please don't get me wrong. I would never want to over-complicate things. That's why I love Vaultwarden with Caddy setup. I'm searching for as little tech as necessary to be reasonable secure. And if Vaultwarden and Caddy suffice for that, I would be more than happy.

[BlackDex]

Mostly because of legacy i think. The built-in rate limiting is newer then the wiki.

Also, Vaultwarden doesn't block total access to the API, only to the login endpoints. Fail2ban can block that IP to access your whole server, and not only Vaultwarden.

[maximilianwank]

Ok, it's a valid point to block the IP from the whole server. I did not think about that because in my case, Vaultwarden would be the only service on it.

[kpfleming]

With 2FA enabled, brute-force is a little bit harder but not impossible. To be precise, the entropy added by a 6 digit code is ~20 bits.

I think you may have misunderstood how 2FA works in this situation. First, there are multiple 2FA options, not just TOTP. Hardware tokens, for example, provide a substantial 2FA security benefit and make it extremely difficult to brute-force attack a password.

TOTP, though, while it is a '6 digit code', is a code that changes every 30 seconds. There are nearly 1 million possible codes which will need to be attempted within the 30 second window in order to be successful. Tools like fail2ban can easily notice rapid failures and delay (or block) further attempts so that the code will expire and the attempts will have to start over again.

[maximilianwank]

I know that there are more 2FA options, but for my use case, only TOTP is relevant. Thank you for your summary, I was absolutely aware of that. Contrarily to passwords, the entropy does not get smaller after each attempt, but is resett after 30s.

Two things can delay brute-forcing: High entropy and rate limits. TOTP is surprisingly vulnerable to brute-forcing (see here). Hence, respective rate limits are crucial and I just think that

When two-factor-authentication is not in use, it is (in theory) possible to brute-force user passwords and thus gain access to their account.

can be misunderstood in the sense "any 2FA only leaves a theoretical chance of being brute-forced".

[maximilianwank]

Maybe my "a little bit" was also easy to misunderstand 😬